import { WorkerEntrypoint } from "cloudflare:workers";
export interface DlpValidationRequestInfo {
    method: string;
    url: string;
}
export interface DlpValidationInput {
    entryId: string;
    accountId: string;
    userId?: string;
    /** Start index of the DLP match in `excerpt`. */
    start: number;
    /** End index of the DLP match in `excerpt`. */
    end: number;
    /** Base64-encoded excerpt containing the match and surrounding context. */
    excerpt: string;
    requestInfo: DlpValidationRequestInfo;
}
export type DlpValidationVerdict = number | "veto";
export interface DlpValidationResult {
    /**
     * A confidence score from -1 to 1, or `"veto"` to reject the match.
     * A score of 0 does not affect confidence. Positive scores increase
     * confidence, while negative scores decrease it.
     */
    score: DlpValidationVerdict;
}
/**
 * The Worker MUST export its validation entrypoint as a class named `DlpValidationEntrypoint`.
 *
 * @example
 * ```ts
 * export class DlpValidationEntrypoint extends DlpValidation<Env> {
 *   async validate(input: DlpValidationInput): Promise<DlpValidationResult> {
 *     const hostname = new URL(input.requestInfo.url).hostname;
 *
 *     if (await this.env.TRUSTED_DOMAINS.get(hostname)) {
 *       return { score: "veto" };
 *     }
 *
 *     if (input.entryId === "credentials") {
 *       return { score: 0.5 };
 *     }
 *
 *     return { score: 0 };
 *   }
 * }
 * ```
 */
export declare abstract class DlpValidation<Env = Cloudflare.Env, Props = {}> extends WorkerEntrypoint<Env, Props> {
    abstract validate(input: DlpValidationInput): DlpValidationResult | Promise<DlpValidationResult>;
}
/** Gateway-managed continuation to the original upstream. */
export type GatewayMiddlewareNext = (request: Request) => Promise<Response>;
/** Gateway metadata describing the original request. */
export interface GatewayMiddlewareContext {
    readonly srcIp: string;
    readonly srcPort: number;
    readonly dstIp?: string;
    readonly dstPort?: number;
    readonly networkProtocol: string;
    readonly embeddedProtocols?: readonly string[];
    readonly sni?: string;
    readonly host: string;
    /** Original request URL normalized by Gateway. */
    readonly uri: string;
    /** Destination category IDs, not category names. */
    readonly domainCategories?: readonly number[];
    readonly onrampType?: string;
    readonly vnetId?: string;
    readonly proxyEndpoint?: string;
    readonly internalSrcIp?: string;
    readonly accountId: string;
    /** UUID of the policy that selected this middleware. */
    readonly policyId: string;
    /**
     * Resolves the identity when the user is identified, resolves `null` when there is no
     * identified user, and rejects if the identity lookup failed.
     */
    identity(): Promise<GatewayIdentity | null>;
    /** Rejects if device posture is unavailable. */
    devicePosture(): Promise<GatewayDevicePosture>;
}
export interface GatewayIdentity {
    readonly email?: string;
    readonly name?: string;
    readonly groups?: readonly GatewayIdentityGroup[];
    readonly samlAttributes?: readonly string[];
    readonly oidcClaims?: readonly string[];
}
export interface GatewayIdentityGroup {
    readonly id?: string;
    readonly email?: string;
    readonly name?: string;
}
export interface GatewayDevicePosture {
    readonly checks: GatewayDevicePostureChecks;
}
export interface GatewayDevicePostureChecks {
    /** Identifiers of posture checks that passed; may be empty. */
    readonly passed: readonly string[];
}